Overview

overview

8

Static

static

1

npcap-1.72.exe

windows7-x64

8

npcap-1.72.exe

windows10-2004-x64

8

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ll.exe

windows7-x64

4

$PLUGINSDI...ll.exe

windows10-2004-x64

4

$PLUGINSDI...re.dll

windows7-x64

3

$PLUGINSDI...re.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

NPFInstall.exe

windows7-x64

4

NPFInstall.exe

windows10-2004-x64

4

x64/NPFInstall.exe

windows7-x64

4

x64/NPFInstall.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    68s
  • max time network
    71s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 18:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    npcap-1.72.exe

  • Size

    1.1MB

  • MD5

    cab256acf99dc6e0685c0567ea6ee658

  • SHA1

    08aefa7d9a941ffe7d5c29d6b65d115109b5e2b7

  • SHA256

    b0efd269d32e581da747e5050ef98d2eb91e6de9080e0918f5af85b485a4bdd1

  • SHA512

    7f2147cd7d2e0e044e4e46c26df015decc4ae4c51d8500e91f1155cfe91e58c38d5f9a10710e6c70ba7ab590a4828e344ac32f28ecefaf9557429caac626af9b

  • SSDEEP

    24576:uZHcNHqqSX6AQzHlPnK7N1F7nJRFoK7EjvEYwa2MVZcXxZzHN9zqn4:aTUHlPK7rFj3qK7a2MV43O

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 8 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Drops file in System32 directory 42 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 38 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\npcap-1.72.exe
    "C:\Users\Admin\AppData\Local\Temp\npcap-1.72.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\NPFInstall.exe
      "C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\NPFInstall.exe" -n -check_dll
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4700
    • C:\Windows\SysWOW64\certutil.exe
      certutil -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\roots.p7b"
      2⤵
      • Manipulates Digital Signatures
      • System Location Discovery: System Language Discovery
      PID:4548
    • C:\Windows\SysWOW64\certutil.exe
      certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\signing.p7b"
      2⤵
      • Manipulates Digital Signatures
      • System Location Discovery: System Language Discovery
      PID:2456
    • C:\Program Files\Npcap\NPFInstall.exe
      "C:\Program Files\Npcap\NPFInstall.exe" -n -c
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\SYSTEM32\pnputil.exe
        pnputil.exe -e
        3⤵
          PID:2320
      • C:\Program Files\Npcap\NPFInstall.exe
        "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        PID:3580
      • C:\Program Files\Npcap\NPFInstall.exe
        "C:\Program Files\Npcap\NPFInstall.exe" -n -i
        2⤵
        • Drops file in Drivers directory
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4716
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
      1⤵
        PID:1248
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{44c70fe3-f706-d846-a0bf-19dd30bddc3c}\NPCAP.inf" "9" "405306be3" "0000000000000148" "WinSta0\Default" "00000000000000E8" "208" "C:\Program Files\Npcap"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:3156

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\PROGRA~1\Npcap\npcap.cat
        Filesize

        12KB

        MD5

        3fd9a520f8b768eee9ee35eedec6bf3d

        SHA1

        302f9b44e602c00f309cef47e0657148b8b0a741

        SHA256

        612f6989db53adf27aa9e53f9c6ff7061012a529853849019f0cb6da5ab67d8e

        SHA512

        4ef544970857028641da7c5d59a2feb28a5eded8d3b37f6e7b43b0a036d83b27bb2d8b49f9ed9b73a89ce70f310efda2e49220306a982d8893177740d0b3d6c9

        Download Submit

      • C:\PROGRA~1\Npcap\npcap.sys
        Filesize

        75KB

        MD5

        c41047f5dc12cb06027b8c9180ba50ec

        SHA1

        b3990659a5d926bebbd3677123bf5150700d521c

        SHA256

        34d8eb66ba1bb1bc4a0f342d6346868e1d6049d19034a4ce9c6e98f0c1ecfc99

        SHA512

        962e8c728f9269ddcf3547cb8d78a1d893e64e6ccc75191ca718500e1a5ae3b58530721f8703ccd6a8e0db316a09b0f99fc03ca79acd16f1082c63f46b159b3a

        Download Submit

      • C:\Program Files\Npcap\NPCAP.inf
        Filesize

        8KB

        MD5

        04c7944e5a04629fc393cadf44293136

        SHA1

        6d292051319573e4315c9e2988f53501793c57dc

        SHA256

        6b9273ab4333e5ec67fd4ff044c43916dfc6939bfefadc911f5c5a2dfae2db65

        SHA512

        2070fde243093f7f2d970cf9af876fbc829e72c43c929d03db5ac617d8c2d6d007e767cbe0f56563b7acb8b507bb7cb1f6cbb85d77c3a686fc0d1cdd3bddae88

        Download Submit

      • C:\Program Files\Npcap\NPCAP_wfp.inf
        Filesize

        2KB

        MD5

        722fc22cb6b7556bd826c80a5d593607

        SHA1

        0863253fa38d0a4b7379846d415a9e43a2b5396f

        SHA256

        a68b8379090572eb3c4d7b8f4fd00c10ce31708e32c2fb86fb6b4581b6085720

        SHA512

        b2fafa2c0ccc5cbb6d707077bc3d147ac3b3b7a005b68a53d0e8df1268879aa29addd8bf36f01fd30f13a76cea311b521a8e2e38101df0516bf48b799b856a55

        Download Submit

      • C:\Program Files\Npcap\NPFInstall.log
        Filesize

        1KB

        MD5

        8f986202b50918e6b12c928fdfc43d90

        SHA1

        c69ae080bfa2913044310585b3cfb00d7eabcb4f

        SHA256

        46593ec834bc54f21732d94a01b9cfb9c8e074bb7cea33ba4c2de630c59db90a

        SHA512

        a2cbdded28b4a7c2afb19bb560bd1244376c8f2a35c08aa8615923a27333fd5ea32ec8ec83466146f11def64f9e2b7e95bed12d1a00ce223a975dcbcd0dd3bfe

        Download Submit

      • C:\Program Files\Npcap\NPFInstall.log
        Filesize

        1KB

        MD5

        3dd6a73ab68f1e36d4932da88661caac

        SHA1

        2d4eaa6d20bd79bebc6e54ace58867284b3c83bc

        SHA256

        8b0b714f9309493115144c4f6d6eb61400818b96bbde8a61a6ddda31d67b5f6d

        SHA512

        07a96282ae8d710025ee393b67aabd0a6584d3738e733e840c45057b66815fb9216c87ee8952b0dafe8f6a4cb20425e6cdfa0ec4441cfbfc381f409989dcbb90

        Download Submit

      • C:\Program Files\Npcap\NPFInstall.log
        Filesize

        2KB

        MD5

        db8732009ef018aff95a1ceb02c99c86

        SHA1

        e721f54219ea80ff6265a80f20a18290935b8408

        SHA256

        87de5c7c711d820adda3636383d7a951f10b4fc35ffce65e113abc8180efbb1f

        SHA512

        d50e853efdc7736490b345c0b398c13e8987fa29b65aa9996f0cf5b5e875d0bfcb5cb05ceee52d08ebcc7e3d2f6fa2802dc32273041ccca879db40c6348df8c0

        Download Submit

      • C:\Program Files\Npcap\NPFInstall.log
        Filesize

        3KB

        MD5

        7b4580e960109c17d0ac11124b5ea724

        SHA1

        29aa657101c7ccff07df412f81e34801cadf7a78

        SHA256

        09e99e944d5dc263887b9de47062da51b14d19a3d565d2e1626b74df9aa5f6f0

        SHA512

        1e7cf3f5f173b4bec0e69782175678ce05c8099231918c263daf6bc8840ceaf4832eb65c9d027582c7c38cc9cec043ca2836f190e4fc01309d94328387e3a336

        Download Submit

      • C:\Program Files\Npcap\NPFInstall.log
        Filesize

        4KB

        MD5

        01d2394780b0409ee655ace49a6e431e

        SHA1

        b11f7a6f69bcd9578896c53942388343aa66f412

        SHA256

        a1a9aeff185e602318a3da1d73f22a702f5c7edf2ab6a0ccb90b7e46fea291db

        SHA512

        1e2cf674b7b55e790145871afaccdef9bac11cd4d635f26d4d88f9595e383ccac1dcc0cd539e87323d59b6c05a67b322bca2921bdfc1d3dcc119f5c6d9c87268

        Download Submit

      • C:\Program Files\Npcap\NPFInstall.log
        Filesize

        4KB

        MD5

        b191ead1cbe6751e681b1d43ffc0bb6b

        SHA1

        5b9cdb367d9040d2dd9a436f33bc1a68c98e1d3b

        SHA256

        6900c5c02a19368fe75be8e03fd0840199aa6b7a4d56b4b61b1ee55387df6022

        SHA512

        7d8b8147516371619ac87acae2ae11fa644d55e91262e73c4e5d482fc6d2d38989da95f733392d3b4e28bd5510ea107430db3f5dd5f5e6feba1e5d020cc570af

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        1KB

        MD5

        def65711d78669d7f8e69313be4acf2e

        SHA1

        6522ebf1de09eeb981e270bd95114bc69a49cda6

        SHA256

        aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

        SHA512

        05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        17KB

        MD5

        a55cd35e67ea8119b611d76e06669abb

        SHA1

        0d717591492bd6177b2591b9045134ce7f98372b

        SHA256

        3b61631a44aa2875cb4fd8da57b883364862281a7fd13d9e56fecab2b7884692

        SHA512

        30fbd2da59d4a2034b01ee634023fd46d66a87c98314fc46cbb1af1815a411fd3a46bd91a958a069869fa7d043185ac30e0eb79d4594cb853469abf01557adf3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ofs1fozt.hlg.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\InstallOptions.dll
        Filesize

        22KB

        MD5

        170c17ac80215d0a377b42557252ae10

        SHA1

        4cbab6cc189d02170dd3ba7c25aa492031679411

        SHA256

        61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

        SHA512

        0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\NPFInstall.exe
        Filesize

        301KB

        MD5

        69a2863281739e40702e40fde07ef72d

        SHA1

        8cf737fb5845a45445483cb1fae533c5a61da028

        SHA256

        5c2e569db9c5a978004b8fbf04ed372071ad998d759a12e5aaba470df158889e

        SHA512

        2315a4aa52f579a3633bd9c61c293b9fa78725d8331deee6ca24db70fb2565f431fc0f7f1ee84881b2e34b778ffc91c45e1b694ae517cdd266b0875e7089f178

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\System.dll
        Filesize

        19KB

        MD5

        f020a8d9ede1fb2af3651ad6e0ac9cb1

        SHA1

        341f9345d669432b2a51d107cbd101e8b82e37b1

        SHA256

        7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0

        SHA512

        408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\final.ini
        Filesize

        568B

        MD5

        cae757421db8d011e41266bfd9439885

        SHA1

        7108a9f0740ee4e3a118f6ac9212e0446f074181

        SHA256

        ff350a68202aadb145f590c8579f9284d2e3c324b0369fde39e5a3a31d7b8204

        SHA512

        785d19c796834065c823a7da99036378bba54b932ea1e47d4ba0c1d123a0a09ec307a3459fb862221de74ce61d9a8d7ec73901c9de007d31e7b39eb7a19b16b5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\nsExec.dll
        Filesize

        14KB

        MD5

        f9e61a25016dcb49867477c1e71a704e

        SHA1

        c01dc1fa7475e4812d158d6c00533410c597b5d9

        SHA256

        274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

        SHA512

        b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\options.ini
        Filesize

        2KB

        MD5

        924e8d57fd505728e9e4c11497169946

        SHA1

        ddbb7c9ca35cc7de3dddaf309a7c7e51df2f6503

        SHA256

        43020343ded3f552e0e1344cefc88056be15a9c153c526c48a37de85fb501dd6

        SHA512

        1206758ccaaa88909d76db686dd41bc0f61377d419e23b6c7f9fbe87c2484e0da679556f9e766e7dd13a2c1355b697d1b837b7c65f9ca8cb96215b3d959d6d62

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\roots.p7b
        Filesize

        1KB

        MD5

        397a5848d3696fc6ba0823088fea83db

        SHA1

        9189985f027de80d4882ab5e01604c59d6fc1f16

        SHA256

        ad3bca6f2b0ec032c7f1fe1adb186bd73be6a332c868bf16c9765087fff1c1ca

        SHA512

        66129a206990753967cd98c14a0a3e0e2a73bc4cd10cf84a5a05da7bf20719376989d64c6c7880a3e4754fc74653dd49f2ffeffd55fc4ee5966f65beb857118c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsg53DA.tmp\signing.p7b
        Filesize

        7KB

        MD5

        dd4bc901ef817319791337fb345932e8

        SHA1

        f8a3454a09d90a09273935020c1418fdb7b7eb7c

        SHA256

        8e681692403c0f7c0b24160f4642daa1eb080ce5ec754b6f47cc56b43e731b71

        SHA512

        0a67cc346f9752e1c868b7dc60b25704255ab1e6ea745850c069212f2724eba62ffaaa48309d5eba6ae0235223518610fb4b60fc422e4babba4f33d331c71db5

        Download Submit

      • memory/1388-426-0x0000000005540000-0x0000000005B68000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/1388-444-0x0000000006800000-0x0000000006822000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1388-439-0x0000000005EC0000-0x0000000006214000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/1388-440-0x00000000063D0000-0x00000000063EE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1388-441-0x0000000006400000-0x000000000644C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1388-442-0x0000000006830000-0x00000000068C6000-memory.dmp

        Filesize

        600KB

        Download

      • memory/1388-443-0x00000000067B0000-0x00000000067CA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1388-429-0x0000000005D50000-0x0000000005DB6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1388-445-0x0000000007980000-0x0000000007F24000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/1388-428-0x0000000005CE0000-0x0000000005D46000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1388-425-0x0000000004E30000-0x0000000004E66000-memory.dmp

        Filesize

        216KB

        Download

      • memory/1388-427-0x0000000005500000-0x0000000005522000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4756-464-0x0000000006F40000-0x0000000006F72000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4756-462-0x00000000056F0000-0x0000000005A44000-memory.dmp

        Filesize

        3.3MB

        Download